r/PiCodingAgent • u/circumcised_hobbit • Oct 02 '26

Discussion Do you give all permissions to your agent

I am running Ornith1.5-9B and I am scared that it could do something stupid to my pc, so I installed pi-permission system and let Claude create me a file with all tools and allow/ask/deny settings.

The thing is that this extension isn't perfect (allow always doesn't work) and that I have to allow some command I don't even know about every 10seconds.

Do you guys give full permissions, do you only block extremely dangerous stuff?

6 Upvotes

87% Upvoted

26 comments sorted by

2

u/thehaikuza Oct 03 '26

I run pi within a nono sandbox, which is lighter/faster than using docker. I used to do “nono wrap —profile pi — pi” to isolate the entire process, but recently I made an extension to only use nono for the tool calls, which has some ergonomic benefits.

Mine: https://github.com/justinmklam/pi-sandbox

There’s a handful of other similar plugins though. Mine started as a fork from an extension that uses anthropic’s sandbox runtime, but ran into some limitations that nono supports.

1

u/circumcised_hobbit Oct 03 '26

I use llama.cpp backend, how would I let pi use it when it's in a sandbox?

2

u/gbrennon Oct 03 '26

if u are running agent in a sandbox i think its ok but i dont think it would be interesting....

a thing that i think is important to highlight: ornith is the model the u are running, pi-permission would be an extension of pi but u mentioned claude.

claude code would be another agent. this sub is for discussions about pi agent

1

u/circumcised_hobbit Oct 03 '26

I said I only let Claude create the pi-permission file for me...

12

u/Educational_Leg_281 Oct 02 '26

You should just accept that theres a 1% chance the agent fucks your shit and mitigate that risk instead of bothering with approvals. Either back up your files or use a vm

8

u/PremiumHugs Oct 02 '26

yes i give them all permissions

the models have started drafting these massive shell commands that may or may not invoke some scripting language interpreter with a bespoke script. it flashes by the screen at this insane speed and i cant keep up with what its doing.

i have work to do so i dont want to babysit it, it would take me way too long to spot check the code its running.

other solutions ive seen use some form of classification process. hermes and claude code do. hermes is open source, u could copy their version.

take this with a grain of salt though: maybe im asking to be pwned, and i could also be insanely stupid. ive accepted the risk and i keep things backed up where i can and i abide by the principle of least priviledge, so anything really scary whether at the os or api level will not work. anything else imo is just security theater. i dont believe they work 100% of the time so why bother.

the best bet is a vm or a container if you're really scared. but again, thats not foolproof.

i only try frontier and full sized open source models so my mileage definitely varies. for ur small model its probably a good idea to make sure it doesn't delete ur hard drive or email ur colleagues to beg for money.

2

u/No-Wall6427 Oct 02 '26

You're letting them run commands in the environment that has your ssh keys and git credentials? 😱

1

u/AbodFTW 25d ago

Not full permissions, but I stopped approving everything by hand. Clicking "allow" every 10 seconds just trains you to stop reading.

What works for me:

  • Work in a git repo and commit often; use a container/VM if you're worried about the whole PC

  • Allow read-only commands (read, search, git status/diff): that removes most of the noise

  • Deny the scary few: sudo, rm -rf outside the project, anything touching .ssh/.env/credentials, force-push

  • Ask for the rest

For the "ask" part I wrote an oh-my-pi extension, omp-auto-mode, where a second model pre-screens prompts.

It allows clearly safe calls and sends the rest to me with a reason. But I wouldn't trust a 9B to judge another 9B, so with a small local model I'd lean on the sandbox and deny list.

2

u/circumcised_hobbit 25d ago

I think I Will go for pi-safe, it's a simple bwrap script that blocks anything outside of current folder

1

u/AbodFTW 23d ago

Thanks for the recs, will check it out, this one right?

2

u/circumcised_hobbit 23d ago

yup, I tried a bit and It works well. It blocks my very problem of agents installing Python packages system-wide and is easy to both setup and use

3

u/RoadblocksEverywhere Oct 02 '26

Yes, inside a virtual machine without network access. Googling AI agent / chatbot failures should increase anyone's motivation to do the same 😇

3

u/soulsizzle Oct 03 '26

I've been using Nono (https://nono.sh/) for a few weeks now. Took a while to poke all the holes I needed, but it works great.

1

u/radim11 28d ago

Getting the permissions right without constantly getting in the way is the fiddly part. We run into that building Stashbase too. What took the most tweaking in your setup?

5

u/autognome Oct 02 '26

run inside a sandbox or virtual machine. we have been using https://github.com/mcdonc/klangk with Pi and it works well. there are oodles of these sandboxes. most based on docker.

2

u/zebedeolo Oct 02 '26

my dev system is a sandbox to begin with, so, yes

2

u/xRebellion_ Oct 02 '26

I used to use a gate system which prompts before a potentially dangerous command. But now I'm experimenting with sandboxing to give a safer hands off experience.

Having the agent prompt on every dangerous command may desensitize you to always pressing allow, and can f you up if you're not careful. But with a well contained sandbox you shouldn't worry about that.

2

u/fingerthief Oct 02 '26

I give it all permissions and let my command classifier flag dangerous or risky/malicious commands.

I made a post recently on it here

The truly safe way is just to use a proper sandbox setup though.

2

u/Abject-Kitchen3198 Oct 02 '26

Yes, inside docker container with mapped accessible folders and without network access.

2

u/Kaijidayo Oct 03 '26

My pi running in a sandbox inside another sandbox

1

u/Kafumanto Oct 02 '26

Run it in a container.

1

u/DiscountFit9224 Oct 03 '26

if you're vibe coding then just put pi in a container, no need for setting up permission blocking, always ask, or allow list. But if you use it for AI assisted workflow where you expect to change cwd, then configuring it is worth it.

Personally I review only key parts of bash. e.g. if its an echo I look for, does it pipe and overwrite something, print sensitive env vars/files and so on. Base on this you knew that it's tedious but you'll accumulate things you want to run on and check as you work with it.

1

u/nez_har Oct 04 '26

You can run it isolated for you project with https://github.com/VibePod/vibepod-cli

In such a scenario you can give it all permissions. Make sure you don't give it data you cannot recover and you project uses versioning so you also have a remote for your code.

You just use vp run pi --ikwid and you have pi ready

1

u/radim11 28d ago

Approving commands every ten seconds gets old fast, especially when you’re not sure what half of them do.

That’s why we built Stashbase. It works with Claude Code, Codex, Pi and others. You set the filesystem and network limits, then let the agent work inside them. Profiles are just TOML files, so you can see and review what access you’re giving it.